Hi Christophe, Thanks for bringing this to our attention. You are right, we don’t expose any xml interface in Kata. The affected go package mentioned is "encoding/xml" and we do not vendor that in any of our Kata components. So, I don’t think we are impacted by the vulnerability. Thanks, Archana On 12/15/20, 8:55 AM, "Christophe de Dinechin" <cdupontd@redhat.com> wrote: Hey Team, In case you have not seen it yet, a new vulnerability in how Go handles XML has just been disclosed: https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ I suspect that we are indirectly impacted by this, although I have not read the disclosure in details yet. From a very cursory search in our code base, it looks like several vendored components may be directly hit. I don't see any immediate risk, in the sense that I don't think we expose any XML interface. But I may be wrong. What do you think? Thanks Christophe _______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev